A network sniffer monitors and network environment events on one or more visible computer networks. Those events may then be displayed to a network specialist for analysis, and may include information for recorded events, such as event type, recording time, packet header, non-encrypted packet payload, analysis of protocol flows, timing, etc. This information allows the specialist to find and repair network problems and to improve network performance by changing the network topology and configuration. A wireless sniffer may typically be implemented as a passive receiver equipped with an omnidirectional antenna, and such a wireless sniffer may monitor and record wireless events belonging to all networks in range.
Some industry standards require devices to have similar environmental measurement capabilities by user equipment (UE) devices. For example, the 3rd Generation Partnership Project (3GPP) defines a way to minimize drive tests by gathering network environment information from phones. Some large enterprises may use network environment information collected by client computers to optimize their networks. This implementation is relevant for wireless technologies where an appropriately placed receiver with an omnidirectional antenna may be assumed to be able to receive and decode all transmissions from devices in range.
In wireless technologies where transmit beamforming is used, such as Wi-Fi SU/MU-MIMO and WiGig, the above implementation may not be feasible, since an omnidirectional receiver, no matter how centrally located, may not be assumed to receive and decode transmissions of other devices in range. This is relevant in WiGig networks, where propagation properties are very similar to light propagation, and therefore, all parts of sent packets are beamformed for directivity.
To overcome this problem, multiple sniffers may be used. However, this creates a further problem in the synchronizing of data from different sniffers to create a coherent picture to the specialist. The timestamp from monitored network events are problematic because packets may belong to different networks and hence have a different time base.